[ Vendor · 16 CVEs ]
OpenSSL
CVEs affecting OpenSSL published in the last 30 days, plus any OpenSSL CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-84782 | 29 Sep 2026 | CVSS 8.2 | OpenSSLIssue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The… | Fix |
| CVE-2026-84783 | 29 Sep 2026 | CVSS 7.5 | OpenSSLIssue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while… | Fix |
| CVE-2026-84784 | 29 Sep 2026 | CVSS 7.5 | OpenSSLIssue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection… | Fix |
| CVE-2026-75805 | 29 Sep 2026 | CVSS 5.3 | OpenSSLIssue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate… | Fix |
| CVE-2026-75806 | 29 Sep 2026 | CVSS 5.3 | OpenSSLIssue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted… | Fix |
| CVE-2026-77696 | 29 Sep 2026 | CVSS 3.7 | OpenSSLIssue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An… | Fix |
| CVE-2026-75804 | 29 Sep 2026 | CVSS 5.3 | OpenSSLIssue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit… | Fix |
| CVE-2026-72897 | 29 Sep 2026 | CVSS 7.5 | OpenSSLIssue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory… | Fix |
| CVE-2026-54872 | 29 Sep 2026 | CVSS 3.7 | OpenSSLIssue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated… | Fix |
| CVE-2026-54873 | 29 Sep 2026 | CVSS 7.5 | OpenSSLIssue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit… | Fix |
| CVE-2026-54875 | 29 Sep 2026 | CVSS 3.7 | OpenSSLIssue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V… | Fix |
| CVE-2026-35189 | 29 Sep 2026 | CVSS 5.3 | OpenSSLIssue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509… | Fix |
| CVE-2026-35191 | 29 Sep 2026 | CVSS 3.7 | OpenSSLIssue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in… | Fix |
| CVE-2026-42772 | 29 Sep 2026 | CVSS 5.3 | OpenSSLIssue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a… | Fix |
| CVE-2014-0160 | 7 Apr 2014 | CVSS 7.5 | OpenSSL Information DisclosureThe (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote… | ExploitedFix |
| CVE-2014-0160 | 7 Apr 2014 | CVSS 7.5 | OpenSSL Information DisclosureThe (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote… | ExploitedFix |